[solved] IPSec with 2.2 -> new phase1, clic apply, firewall becomes unreachable



  • Hello, I have a strange issue with one of my firewalls.

    This is a pfsense 2.2 (amd64) running on an ESXi guest (vmxnet3 drivers). Everything works fine.

    Then, I try to create an IPSec tunnel. But as soon as I create the phase 1 and clic on "apply configuration" the firewall becomes unreachable over the Internet:

    I can't connect to the WAN interface anymore (no IMCP, no TCP, no UDP, nada). So in order to regain access to the firewall I have to restore an old configuration backup (through the ESXi console).

    I have no idea where to look for in order to setup this IPSec tunnel without having the pfsense broken …

    Thanks.
    Nicolas



  • I could go a bit further.

    I setup another IPSec tunnel with another remote gateway: no crash at all, tunnel is up and running fine.

    Then, I tried to setup another tunnel with the previous remote gateway: pfsense is unreachable. I have to restore an old backup and reboot the firewall.

    I don't see why when using a specific remote IP something like this would happen???

    Nicolas



  • I'm answering myself to this "issue" :

    based on this thread (https://forum.pfsense.org/index.php?topic=88208.msg487019#msg487019) I was able to create the tunnel.

    The fact that I was using the same originating IP to setup the firewall than the one in the Phase1 in order to setup the tunnel was causing the problem. So I managed to connect to the firewall with another IP, and no more problem.

    But this is actually kind of weird …

    Anyway, it works, just remember NOT to connect to a remote firewall with the same IP that you'll be using in your Phase1 setup!

    HTH.
    Nicolas